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About the manual 


This manual lists and explains the specific responsibilities of Individual CURF Users, Responsible Officers 
and Contact Officers. It also offers hints on the secure management of CURF Microdata and briefly 
describes the consequences for individuals and organisations of any failure to meet their responsibilities. It 
does so in order to assist compliance with the ABS Terms and Conditions of CURF Access. 
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Introduction 


The quality of ABS data is dependent on the willingness of Australian individuals and organisations to 
respond accurately to our surveys. This is particularly the case for microdata which are subject to fewer 
statistical processes than aggregated information. That willingness to accurately respond is contingent upon 
the trust respondents place in the ABS to maintain the confidentiality of their information. 


To ensure respondent confidentiality is maintained, and in response to the legislative requirement for the 
Australian Statistician to release microdata only ‘.. in a manner that is not likely to enable the identification 
of a particular person or organisation to which it relates’, the ABS: 


e removes all directly identifying information such as names and addresses, etc. 

e ensures data items likely to identify respondents are released in broad categories only -- for 
example, while a particular survey questionnaire may record the respondents’ home or business 
address, microdata may be released at the State or Territory level 

e checks for records with uncommon combinations of responses, and may alter them slightly to 
ensure individuals or organisations cannot be identified. 


In addition, we place restrictions on how you may use the microdata. These restrictions are set out in the 
legal undertakings signed by each Individual User and their organisation's Responsible Officer (usually the 
CEO). 


These restrictions, and your responsibilities toward them, are discussed in detail in this Manual. Beyond 
controlling the use you make of the microdata, they also relate to your secure management of CURF 
access. 


Careful reading of this Manual is a prerequisite for access to ABS CURF microdata. 
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ABS Terms and Conditions of CURF Microdata Access 


ABS CURF Microdata are released only to organisations with an approved Responsible Officer and a 
nominated Contact Officer. CURFs are released to authorised Individual Users within those organisations 
for specific statistical purposes. Once approved, each Individual User generally remains authorised to 
access ABS CURFs until such time as they leave the organisation. However, the Individual User's access to 
each specific CURF is withdrawn at the completion of the statistical purpose for which it is granted. When an 
Individual User leaves an organisation their access is completely withdrawn, even where they are 
transferring to another CURF user organisation. 


For organisations to gain access to ABS CURF Microdata: 


¢ a Suitably qualified member of the organisation is required to submit and have approved a 
Responsible Officer Undertaking, and to recommit to responsible use of Microdata annually 
through the ABS CURF renewal process (see Who can qualify as a Responsible Officer?) 

e the Responsible Officer must nominate a Contact Officer, or must themselves fulfil this role 

e intending Individual CURF Users must submit and have approved a Personal Deed of 
Undertaking legally binding them to the ABS terms and conditions of CURF access; this is 
achieved through the ABS online CURF registration system, MiCRO 

e Individual Users must submit and have approved a CURF application for each individual 
CURF they require, in MiCRO. 


In order to retain this access, all members of user organisations are required to comply with the instructions 
listed upon the Responsible Officer Undertaking, and the Personal Deed of Undertaking of an Individual 
User in an Organisation provided in MiCRO. See the Consequences of Failing to Comply With the Terms 
and Conditions of CURF Microdata Access chapter of this Manual outlines the ABS actions and possible 
penalties arising from non-compliance. 


Access to ABS CURF Microdata is at all times at the discretion of the Australian Statistician. 
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Individual User: Role and Responsibilities 


As an approved Individual User, you agree to comply with the conditions placed upon CURF microdata use 
in the Personal Deed of Undertaking of an Individual User in an Organisation provided in MiCRO in order to 
protect the confidentiality of survey respondents. Specifically, you are required to: 


e use the CURF microdata only for the statistical purpose specified in your CURF application, and 
to surrender access at completion of that statistical purpose 
not attempt to identify particular persons or organisations, particularly through matching the 
microdata with any other list of persons or organisations 
never use, in any one output from a CURF, more than one geography -- including Socio- 
Economic Indexes For Areas (SEIFA) categories -- in association with State/Territory and more 
than one other data item 
not share any information on particular persons or organisations that you may spontaneously 
recognise within the microdata 
not disclose microdata, either directly or indirectly, to any other person or organisation, other 
than members of your organisation who have been approved by the ABS to have individual 
access to the same CURF 
comply with any other direction or requirement specified in this Manual 
surrender access to CURF microdata 

© after your authorisation expires 

© after your authorisation is rescinded by the organisation which provided it, and 

© upon ceasing to be a member of that organisation. 


Please see Appendix A for more detail on the conditions placed upon CURF microdata use in the Personal 
Deed of Undertaking of an Individual User in an Organisation. 


Responsibilities when using RADL and the ABSDL 


The following responsibilities relate specifically to your use of the: 


Remote Access Data Laboratory (RADL) 
e carefully read and abide by the conditions of use in the 1406.0.55.002 - ABS Remote 
Access Data Laboratory (RADL): User Guide, Mar 2006 (in particular, you are required to 
ensure that any programs you submit to RADL comply with the limitations outlined in the 
User Guide) 
e keep secure any outputs that reveal microdata, and destroy them in a secure manner if 
they are no longer needed 
e do not share your RADL password with anybody, not even other approved Individual Users 
in your organisation 
¢ cooperate with any ABS audits of your RADL activity, and 
¢ comply with all ABS instructions regarding your use of RADL and its outputs. 
ABS Data Laboratory (ABSDL), 
e submit and have approved the relevant ABSDL User Declaration (Supplied upon 
application for access) 
¢ comply with ABS instructions when using the facility 
e do not remove or otherwise communicate to others any outputs from the facility until 
cleared to do so by the ABS, and 
e stay with ABS supervising staff while on ABS premises and, in the event of an evacuation, 


until the emergency is over. 


Acknowledging the ABS in microdata based published outputs 


You are also required to appropriately acknowledge your use of ABS materials in your outputs. See our help 
page Guide to Citing ABS Sources for guidance on this matter. 


For further information on this role, please see the Individual Users section of 1406.0.55.004 - Managing 
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Contact Officer: Role and Responsibilities 


As your organisation's Contact Officer, you are the first point of contact for CURF related matters for both 
the ABS and your organisation's Individual Users. You are your Responsible Officer's delegate in this 
regard. Your main responsibilities are: 


e confirming that each applicant for CURF microdata access claiming to be so is a member of your 
organisation 


e ensuring access to CURF microdata is restricted to approved Individual Users 
e encouraging and assisting Individual Users to maintain comprehensive and up-to-date records in 
MiCRO, including 
© records of their CURF holdings, and 
© up-to-date personal contact details 


e ensuring Individual Users surrender access to CUREFs, along with any microdata extracted from 
CURFs 


© at the completion of the statistical purpose for which their access was approved, and/or 
© upon leaving your organisation. 


For further information on this role, please see the Contact Officers section of 1406.0.55.004 - Managing 
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Responsible Officer: Role and Responsibilities 


The Responsible Officer for each CURF user organisation is that person legally accountable for its activities, 
and for those of its staff and affiliates. This is usually the CEO of the organisation. For further information, 
please see Who can qualify as a Responsible Officer?. 


In signing the Responsible Officer Undertaking, this person accepts responsibility for ensuring all members 
of the organisation comply with the ABS Terms and Conditions of CURF access. 


As your organisation's Responsible Officer, you are accountable for any breach of ABS Terms and 
Conditions of CURF Microdata Access by your organisation's approved Individual Users, and by other staff 
or affiliates not approved to access microdata. 


To assist you with this, you are able to: 
¢ appoint a Contact Officer 


e draw on the support of the ABS microdata Access Strategies Section. 


For further information on this role, please see the Responsible Officers section of 1406.0.55.004 - 
Managing_ABS Confidentialised Unit Record Files (CURFs): A Step by Step Guide. 
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Consequences of Failing to Comply With the Terms and Conditions of CURF Microdata 
Access 


Where Individual Users are found to have breached the ABS Terms and Conditions of CURF microdata 
Access, the ABS will: 


e immediately suspend their access all CURFs, disabling their RADL access and requiring that 
they surrender all microdata in their possession to their organisation's Contact Officer or to the 
ABS pending investigation of the breach 

e inform the organisation's Contact and Responsible Officers that such investigation is underway 

e require the development and implementation of strategies to 

© restrict or overcome the consequences of the breach 
© ensure no repetition of the breach is possible, and 
o depending on the success of these strategies and the severity of the breach 
- reactivate the suspended access, or 
- extend suspension temporarily or permanently, or 
- where justified, suspend or terminate access for the organisation as a whole. 


Where justified by the nature of the breach, the ABS may also invoke Subsection 19 (3) of the Census and 
Statistics Act 1905 which provides that a person who fails to comply with an undertaking given by that 
person in respect of a CURF is guilty of an indictable offence, punishable on conviction by a fine of 120 
penalty units ($13,200) or imprisonment for two years, or both. 
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Secure Storage of ABS CURF Microdata 


ABS CURF microdata must be stored in a manner excluding access by anyone except those specifically 
permitted by the ABS. 


The following are guidelines for storing the microdata and results of your analyses: 


e any computer on which ABS microdata is stored must be kept in a locked room and/or have 
password protection to prevent access by others 

e any information or results stored on a computer network must be kept in a directory with suitably 
restricted access 

e any printouts or any physical medium containing microdata (Such as a CD-ROM provided by the 
ABS) must be kept in a locked room or secured in a locked cabinet when the researcher is not 
present, and 

e you must keep track of datasets and printouts that reveal microdata, so that they can be 
destroyed when they are no longer needed. 


Note: printouts can be destroyed securely by shredding. Your organisation must also provide for a secure 
way to delete computer files so that they cannot be recovered by an unauthorised person. 


These restrictions apply to microdata and to outputs from your analysis that reveal information on individual 
respondents. 


Examples of data that do not reveal such information are: 


e tabulations containing cells with 3 or more contributing sample units, and 
e details of fitted models, such as regression parameters. 


Examples of data that must be kept secure: 


¢ prints of unit records 
e tabulations containing less than 3 contributing sample unit records, and 
e details of unusual unit records that require special treatment in modelling. 
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Appendix A: Personal Deed of Undertaking 


The following extract from the Personal Deed of Undertaking of an Individual User in an Organisation is 
replicated here for reference for those who do not have access to MiCRO. Where any disparity exists 
between this Appendix and the Deed, the Deed takes precedence. 


PERSONAL DEED OF UNDERTAKING OF AN INDIVIDUAL USER IN AN ORGANISATION 


DEED OF UNDERTAKING MADE PURSUANT TO CLAUSE 7 OF THE STATISTICS DETERMINATION 
1983 


WHEREAS: 


(A) Subsection 13(1) of the Census and Statistics Act 1905 provides for the Minister, by legislative 
instrument, to make determinations providing for and in relation to the disclosure, with 


(B) Clause 7 of the Statistics Determination 1983 permits the Australian Statistician to approve the 
disclosure of information in the form of individual statistical records if all identifying information has been 
removed, the information is disclosed in a manner that is not likely to enable identification of the particular 
person or organisation to which it relates, and the Australian Statistician has been given a relevant 
undertaking. 


NOW, | <personal name> 
a member of <organisation name> 


make this Deed of Undertaking in favour of the COMMONWEALTH OF AUSTRALIA as represented by the 
AUSTRALIAN STATISTICIAN and the AUSTRALIAN BUREAU OF STATISTICS (ABS). | HEREBY 
UNDERTAKE that, as a member of the Organisation: 


1. | will comply with the requirements for access to all Confidentialised Unit Record Files (CURFs) 
notified by the ABS in writing to me from time to time, including without limitation by: 


a. reading all material notified by the ABS, including core documentation and periodic 
newsletters; 


b. complying with procedures for access notified by the ABS, which | acknowledge will be 
taken to include: 


i. Those set out in the Responsible Access to ABS Confidentialised Unit Record Files 
(CURFs) Training Manual Edited Edition 2, March 2005 - available at 
www.abs.gov.au, as amended from time to time; and 


ii. those set out in 1406.0.55.004 Managing ABS Confidentialised Unit Record Files 
(CURFs): A Step By Step Guide Version 2, August 2007 - available at 
www.abs.gov.au, aS amended from time to time. 


ili. the requirement to submit a Request for Access to a CURF Form in order to 
granted approval for access to a CURF by the ABS, which form is available at 
www.abs.gov.au, as amended from time to time; 


c. providing any additional information regarding my use of CURFs when requested by the 
ABS; 


d. complying with any supplementary conditions that apply to particular CURFs; and 


e. complying with the CURF access renewal process and any request by the ABS, or its 
agents, to review arrangements concerning storage and use of CURFs; 


2. | will only access CURFs which the ABS have given me approval to access; 
3. | will, in relation to all CURFs that the ABS gives me approval to access: 


a. use the CUREFs only for the statistical purposes approved by the ABS (as specified in the 
applicable Request for Access to a CURF forms); 


b. not attempt to identify particular persons or organisations to which a CURF relates, 
which without limitation includes: 


i. not attempting to match, with or without using identifiers, a CURF with any other list 
of persons or organisations; and 


ii. not attempting to avoid the controls put in place around the means of access (such 
as those used in the Remote Access Data Laboratory (RADL)), which are designed 
to prevent any deliberate or inadvertent misuse of CURFs; 


c. never use, in any one output from a CURF, more than one geography (including Socio- 
Economic Indexes For Areas [SEIFA] categories) in association with State/Territory and 
more than one other data item; 


d. not disclose, either directly or indirectly, any CURF Microdata to any person in the 
Organisation who has not been approved by the ABS to access that CURF, which without 
limitation includes; 


i. not allowing people (other than those approved by the ABS) to access CUREFs in 
any form; 


ii. not sharing my RADL access and password with anyone - including other people in 
the Organisation that are approved to access CURFs; and 


iii. ensuring that all CURFs in any form (including CD-ROMs, DVDs, files or printout 
with unit records) are stored securely, to prevent anyone without approval accessing 
them; 


e. not disclose, either directly or indirectly, any CURF Microdata to any person outside the 
Organisation; and 


f. after my approval expires in accordance with clause 4: 
i. not attempt to access the CURF(s); and 


ii. return, destroy or otherwise deal with all copies of CURFs or Microdata extracts 
from CUREFs as directed by the ABS, subject to any requirement of law binding on 
me; 


4. | acknowledge that my approval to access a CURF will expire: 


a. when | no longer require access for the statistical purpose for which access was 
approved under clause 3(a); 


b. when | leave the Organisation; or 


c. if approval for me to access the CURF is revoked by the ABS or the Organisation 
whichever is the earlier; 


5. | acknowledge that: 


a. a breach of the terms of this Deed of Undertaking may result in the ABS immediately 
withdrawing my and my Organisation's access to CURFs; and 


b. failure by me to comply with the terms and conditions of this Deed of Undertaking may 
be an offence under subsection 19(3) of the Census and Statistics Act 1905, the penalty for 
which is 120 penalty units or imprisonment for 2 years, or both; and 


6. | agree that this Deed of Undertaking is to be construed in accordance with, and any matter 
related to it is to be governed by, the law of the Australian Capital Territory. 

Dated this Tuesday 1st of September 2009 

Executed as a deed: 

SIGNED SEALED AND DELIVERED by: 

<personal name> 
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